Bug: Attributes need to be escaped in Linked_posts.php

Hi @metaphorcreations ,

Thank you for reaching out.

To better understand your situation and learn more about your setup, could you provide the version of the following?

1. PHP
2. WordPress
3. The Events Calendar
4. Theme and Version

1. PHP 8.2.24
2. WP 6.2
3. TEC 6.8.0 – TEC Pro 7.3.0
4. Custom theme

Please just pass this along my initial submission to your developers. This attribute should be escaped for security reasons in the first place, regardless of the bug.

• This reply was modified 1 week, 5 days ago by metaphorcreations.

Hi @metaphorcreations ,

Thank you for your message and the information.

I am seeing a different code for the “data-create-choice-template” select attribute in version 6.8.1 of The Events Calendar.

On the other hand, since you are using one of our premium plugins, the Events Calendar Pro, please open a Support Ticket on our Help Desk so we can better assist you. Also, this is for us to follow WordPress Forum Guidelines regarding premium users.

Thanks for getting back to me. You are correct, it looks like that line of code is slightly different now in 6.8.1, but the issue is still the same. We are using the pro plugin, but the issue is stemming from the free plugin. Here is the current code in the free plugin, within the Linked_Posts.php file:

data-create-choice-template="<?php echo __( 'Create: <%= term %>', 'the-events-calendar' ); ?>"

This caused the issue below, when trying to add a new venue with the Community Events form:

The attribute still needs to be escaped, like this:

data-create-choice-template="<?php echo esc_attr( __( 'Create: <%= term %>', 'the-events-calendar' ) ); ?>"

When the attribute is escaped, it resolves the issue:

Thanks for the help!

• This reply was modified 1 week, 4 days ago by metaphorcreations.

Hi @metaphorcreations ,

Thank you for your message and information.

It is important for our engineering team to know where and how the issue is occurring, but somehow I have not been able to reproduce it. Could you provide the direct URL of the page (or detailed steps to get to it from a testing environment) having the issue?

Hi @metaphorcreations

As Tristan noted in the previous message, it appears that you currently hold an active license with our services. To ensure we assist you more effectively and adhere to the WordPress Forum Guidelines for premium users, we kindly request that you submit a Support Ticket through our Help Desk. This will allow us to better address your specific needs and provide you with the best possible support. Thank you!

I am working on a clients website and they hold the license for the pro version, so I don’t have direct access to their account.

I posted instructions on how to view the issue in my first comment, there is no direct access to the form as the page has a redirect if the initial small form is not submitted first. You need to submit the initial form and then you’ll see the Community Events Forms.

This is related to the Community Events Forms, but the issue stems from the free version of the plugin. I’ve already provided the solution to this issue. It’s a small issue that should be a pretty quick fix.

Hi @metaphorcreations

To get you the help you need, please submit a support ticket through our Help Desk. This helps us follow the WordPress Forum Guidelines made for our awesome premium users.

If you’re having trouble accessing your client’s account, no worries! You can still submit a pre-sales ticket. Just share the details of the issue you’re facing and include your license key. This will help us verify your account so we can provide you with the best support possible.

Thanks for your understanding, and we look forward to assisting you!

Hi there,

It seems like this thread has been quiet for a bit, so we’ll go ahead and close this for now. However, if any further questions or concerns come up, please?submit a support ticket?through our Help Desk.